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closed in accordance with the practice under Ex parte Quayle, 1935 CD. 1 1 , 453 O.G. 213. 
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Replacement drawing sheet(s) including the correction is required if the drawing(s) is objected to. See 37 CFR 1.121(d). 
1 1 )□ The oath or declaration is objected to by the Examiner. Note the attached Office Action or form PTO-152. 

Priority under 35 U.S.C. § 119 

12)n Acknowledgment is made of a claim for foreign priority under 35 U.S.C, § 1 19(a)-(d) or (f). 
a)n All b)n Some * c)^ None of: 

1 Certified copies of the priority documents have been received. 

2. n Certified copies of the priority documents have been received in Application No. . 

3. n Copies of the certified copies of the priority documents have been received in this National Stage 

application from the International Bureau (PCT Rule 17.2(a)). 
* See the attached detailed Office action for a list of the certified copies not received. 



Attachment(s) 

1) Notice of References Cited (PTO-892) 

2) dl Notice of Draftsperson's Patent Drawing Review (PTO-948) 

3) Q Infonmation Disclosure Statement(s) (PTO/SB/08) 

Paper No(s)/Mail Date . 



4) O Interview Summary (PTO-413) 

Paper No(s)/Mail Date. . 

5) n Notice of Informal Patent Application 

6) □ Other: . 



U.S. Patent and Trademark Office 
PTOL-326 (Rev. 08-06) 



Office Action Summary 



Part of Paper No./Mail Date 20070622 



Application/Control Number: 10/628,006 Page 2 

Art Unit: 2137 

DETAILED ACTION 

1 . Claims 1 -22 were pending in the instant application at the time of the previous 
Office Action, mailed January 1 1 , 2007. By the latest amendment, filed April 2, 2007, 
ciaimsS, 19, and 22 have been cancelled. Therefore claims 1-7, 9-18, 20, and 21 
remain pending and have been examined. 

Response to Arguments 

2. Applicant's arguments with respect to claims 1-7, 9-18, 20, and 21 have been 
considered but are moot in view of the new ground(s) of rejection. 

Drawings 

3. The drawings were received on April 2, 2007. These drawings are approved. 

Claim Rejections - 35 USC § 103 

4. The following is a quotation of 35 U.S.C. 103(a) which fomris the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not Identically disclosed or described as set 
forth in section 102 of this title, if the differences between the subject matter sought to be patented and 
the prior art are such that the subject matter as a whole would have been obvious at the time the 
invention was made to a person having ordinary skill in the art to which said subject matter pertains. 
Patentability shall not be negatived by the manner in which the invention was made. 

5. Claims 1-7, 9-18, 20 and 21 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over Gupta et al., US 2003/0004688 A1, and Stellenberg et al., US 
7,134,143. 
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As for Claim 1 , Gupta teaches a method for identifying network traffic [0002] 
comprising: receiving pattern matching data [0043]; comparing the pattern matching 
data with a pattern [0050], [0084]; and detennining whether the pattern matching data 
matches the pattern [0087]. Gupta does not teach the features of assigning a first 
score to a first match if the pattern matching data matches the pattern, and comparing 
the pattern matching data with a second pattern; and assigning a second score to a 
second match if the pattern matching data matches a second pattern. However, 
Stellenberg does teach these features (col. 4 lines 7-18, 30-35, col. 19 lines 20-47). 
Therefore it would have been obvious to one of ordinary skill in the art at the time of 
the Invention to incorporate these features into the system of Gupta. It would have 
been desirable to do so as this would provide for a second level of filtering of 
potentially harmful network traffic. 

As for claim 2, Gupta teaches a method for identifying network traffic as recited in 
Claim 1, wherein the pattern matching data includes application data [0076], [0081], 
[0083], [0095]. 

As for claim 3, Gupta teaches a method for identifying network traffic as recited in 
Claim 1, in the event that the pattern matching data matches the pattern, further 
Including determining a property associated with the network traffic [0063], [0064]. 
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As for claim 4. Gupta teaches a method for identifying network traffic as recited in 
Claim 1, in the event that the pattern matching data matches the pattern, further 
including determining a property associated with the network traffic; wherein the 
property is an application protocol [0063], [0064], 

As for claim 5, Gupta teaches a method for identifying network traffic as recited in 
Claim 1, in the event that the data matches the pattern, further including determining a 
property associated with the data and assigning a score for the property [0055], [0059]. 

As for claim 6, Gupta teaches a method for identifying network traffic as recited in 
Claim 1, in the event that the data matches the pattern, further including determining a 
property associated with the data; and applying a policy based on the property [0055], 
[0059], [0061]. 

As for claim 7, Gupta teaches a method for identifying network traffic as recited in 
Claim 1, further comprising assigning a score to a match if the pattern matching data 
matches the pattern [0055]. 

As for claim 9, Gupta fails to teach the method for identifying network traffic as 
recited in claim 1 further comprising determining a property associated with the traffic by 
comparing the first score and the second score (col. 19 lines 20-47). 
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As for claim 10, Gupta teaches a method for identifying network traffic as recited 
in Claim 1, wherein the pattern matching data includes a string selected from a packet 
[0084], [0085], [0086]. 

As for claim 1 1 , Gupta teaches a method for Identifying network traffic as recited in 
Claim 1 , wherein pattern matching data includes concatenated application data of a 
plurality of packets [0068], [0104]. 

As for claim 12, Gupta teaches a method for identifying network traffic as recited in 
Claim 1, wherein the pattern includes a regular expression [0076], [0081], [0083], 
[0095]. 

As for claim 13, Gupta teaches a method for identifying network traffic as recited in 
Claim 1 , wherein the pattern includes application protocol information [0063], [0064]. 

As for claim 14, Gupta teaches a method for identifying network traffic as recited in 
Claim 1, wherein the pattern includes commonly used port information [0076], [0107]. 

As for claim 15, Gupta teaches a method for identifying network traffic as recited in 
Claim 1, in the event the data does not match the pattern, further comprising returning a 
failure indicator [0104: Alert]. 
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As for claim 16, Gupta teaches a method for identifying networl< traffic as recited in 
Claim 1 , wherein determining whether the pattern matching data matches the pattern 
occurs at the beginning of session [0103: Packet is cached and analyzed upon receipt]. 

As for claim 17, Gupta teaches a method for identifying network traffic as recited in 
Claim 1 , wherein comparing the pattern matching data with a pattern is performed for 
each received data [0103]. 

As for Claim 18, Gupta teaches a method for identifying network traffic [0002] 
comprising: receiving pattern matching data [0043]; comparing the pattern matching 
data with a pattern [0050], [0084]; and determining whether the pattern matching data 
matches the pattern [0087]. Gupta does not teach comparing the pattern matching data 
with a second pattern; and assigning a second score to a second match if the pattern 
matching data matches a second pattern. However, Stellenberg does teach these 
features (col. 4 lines 7-18, 30-35, col. 19 lines 20-47). Therefore it would have been 
obvious to one of ordinary skill in the art at the time of the invention to incorporate these 
features into the system of Gupta. It would have been desirable to do so as this would 
provide for a second level of filtering of potentially harmful network traffic. 
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Claim 20 is directed towards a system that carries out the method steps of claim 1 . 
Claim 20 recites substantially the same limitations as claim 1 and therefore is rejected 
on the same basis as that claim. 

Claim 21 is directed towards a computer program embodied in a computer- 
readable medium that causes a processor to undertake the method steps of claim 1 . 
Claim 21 recites substantially the same limitations as claim 1 and therefore is rejected 
on the same basis as that claim. 



Conclusion 

6. Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Paul E. Callahan whose telephone number is (571) 272- 
3869. The examiner can normally be reached on M-F from 9 to 5. 

If attempts to reach the examiner by telephone are unsuccessful, the Examiner's 
supervisor, Emmanuel Moise, can be reached on (571) 272-3865. The fax phone 
number for the organization where this application or proceeding is assigned is: (571) 
273-8300. 

Information regarding the status of an application may be obtained from the 
Patent Application Infomiation Retrieval (PAIR) system. Status information for 
published applications may be obtained from either Private PAIR or Public PAIR. 
Status information for unpublished applications is available through Private PAIR only. 
For more information about the PAIR system, see http://pair-direct.uspto.gov. Should 
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you have questions on access to tlie Private PAIR system, contact the Electronic 
Business Center (EBC) at 866-217-9197 (toll-free). 

/Paul E. Callahan/ 

6-21-07 ^ 
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